Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


nonep virus will not delete

  • Please log in to reply
1 reply to this topic

#1 spicerss


  • Members
  • 1 posts
  • Local time:10:52 PM

Posted 22 November 2010 - 06:17 PM

On starting my computer normally My Avira antivirus blocks 2 potential threats when I tell it to remove them it then finds 100's more which appear to be crucial normal programs. The Floppy drive is being continuously accessed whilst the computer is running every couple of minutes (I suspect by the anti virus program)

On starting in safe mode I think the problem is being generated by a file that appears in Documents and settings/administrator/start menu/ start up/ wfapvyuy.exe this file is locked and when removed by hijack this at start up it reinserts its self straight away.It preports to belong to macromedia flash player 7 r 14.
A folder win appears in program files with a x33.exe file which also appears to be connected to the nonep virus which changes its number on deletion and reboot x 35.exe x35.exe etc

I have ran Trojen remover which now appears blocked. I have ran super anti spyware and Malware bytes none have sorted out the problem and I suspect they are being interfered with as well as my antivirus avira which finds 1000's of virus hits in full scan. (I hope these are false hits)

I find and delete in the registry
HKLM\...\run(nonep) c:\programfiles\win\x35.exe

HKCU\software\microsoft\windows\current version\run\{35de9e98-ff0b-65ff-be07-b424b7dd8c5bb} C:\Documents and settings\ Administrator\ application data\ Gomoe\omxyd.exe (this file changes its name on rerun and reappears)

I delete the associated files but on restart they all quickly reappear I also find reappearing a set up file for macromedia flash player 7 r14 updates which appears in several places and reinserts its self after the computer has been running after deleting it.
The only file I have deleted and which has not reappeared appeared as a warning in Hijack this HKCU\..\runone [flash player update] c:\windows\system32\macromedia\flash\flashutil10i_Activex.exe which may or may not have been associated with the problem.
Can anyone suggust how I can track down what is causing the virus to reinsert inself on start up and how I remove it

BC AdBot (Login to Remove)


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Moderator
  • 37,011 posts
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:52 PM

Posted 22 November 2010 - 07:54 PM


Please follow the instructions in ==>This Guide<==. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it ==>HERE<== Please include a description of your computer issues and what you have done to resolve them.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

Orange Blossom :cherry:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users